Conventionally, several types of clocks are present in a semiconductor integrated circuit. Generally, a block unit supplied with a clock is called clock domain, and the delivery of data between different clock domains is called clock domain crossing (CDC).
Data in one clock domain (hereinafter, “transmission clock domain”) is delivered to a different clock domain (hereinafter “reception clock domain”), regardless of the timing of a clock used in the reception clock domain.
The data that is input regardless of the timing of the clock in the reception clock domain results in noncompliance with a setup time or hold time and may cause a metastable state in output from a flip-flop (FF).
A metastable state is an unstable state in which both logical value 0 and logical value 1 may be determined. The effect of a metastable state may propagate as a logical value difference to an FF or a combinational circuit downstream, causing the semiconductor integrated circuit to malfunction.
Elimination of the metastable state is impossible as far as CDC is occurring in the semiconductor integrated circuit. Nevertheless, verification that the development of a metastable state does not result in a malfunction of the semiconductor integrated circuit is demanded. Logical verification using an ordinary FF model, however, does not take into account the effect of the metastable state.
FIG. 25 is an explanatory diagram of an example of logical verification using an ordinary FF model. In a circuit model 1, an output end of a transmission FF in a transmission clock domain is connected to an input end of a reception FF in a reception clock domain. A timing chart indicates a case where data (S1) output from the transmission FF does not comply with a setup time of a clock clk2 when the data (S1) is delivered to the reception FF. Despite the noncompliance, however, output data (S2) from the reception FF gives a logical value 1.
To deal with the problem that the effect of the metastable state is not considered, as depicted in FIG. 25, a model of the reception FF is altered into a model enabling simulation of the effect of the metastable state (hereinafter “CDC model”) and verification is carried using such a model (hereinafter “CDC verification”) (see, e.g., Japanese Laid-Open Patent Publication No. 2009-9318).
FIG. 26 is an explanatory diagram of an example of logical verification using a CDC model. In a circuit model 2, an output end of a transmission FF in a transmission clock domain is connected to an input end of a reception FF in a reception clock domain. The reception FF is provided as a CDC model. A timing chart indicates a case where data (S1) output from the transmission FF does not comply with the setup time of the clk2 when the data (S1) is delivered to the reception FF.
Because of noncompliance with the setup time, output data (S2) from the reception FF creates a metastable state. At a rising edge of the clk2, therefore, an FF receiving the data S2 as input data takes on the metastable state to output an unpredictable logical value (0 or 1).
A verification result given by CDC verification is affected by the metastable state, which makes fault-cause analysis difficult in CDC verification. In an ordinary case, therefore, logical verification before a model change is carried out first (hereinafter “function verification”) to confirm that regular functions have no problem. CDC verification is then carried out using the same input pattern used in function verification to confirm that no action that is not compliant with a design specification arises even if random actions are added by a CDC model.
A design for test (DFT) system that detects or pinpoints a failure caused by CDC is known as a system for conducting a test (see, e.g., Japanese National Publication of International Patent Application No. 2004-530865).
An input pattern is, however, a pattern that is made for exclusive use in function verification and is not necessarily an input pattern appropriate for CDC verification. Conventionally, therefore, when transition to an erroneous internal state occurs due to a CDC-caused fault, some input patterns may not cause the effect of the fault to propagate to external output, which poses a problem in that an omission in detecting malfunction may occur.
CDC occurs at several thousand locations in the semiconductor integrated circuit; therefore, the distance from each CDC location to a fault determining location (e.g., output terminal) on a logical circuit is large. This poses a problem of difficulty in identifying CDC as a fault cause.
Even in a properly designed logical circuit, a fault determining location is distant from a CDC location via multiple FFs, combinational circuits, etc. and thus, appears as a shift in signal change timing (cycle unit). Simply comparing the result of ordinary function verification with the result of CDC verification, cycle by cycle, therefore, results in detection of a number of inconsistencies. This leads to a problem of erroneously determining normal operation to be faulty operation.